topic Re: Netflow in General Topics

Netflow

handiansudianto — Tue, 27 Jun 2023 03:43:01 GMT

Hello,

We using solarwinds NTA to capture traffic conversation, but i can see the conversation for my checkpoint is from public ip to public ip. What can we do on checkpoint side so netflow only send conversation from client ip address (not natted ip address) to the internet?

Re: Netflow

PhoneBoy — Tue, 27 Jun 2023 20:04:33 GMT

The IP addresses and TCP/UDP ports reported by NetFlow are the ones on which it expects to receive traffic.
Therefore, for NATed connections, one of the two directions of flow is reported with the NATed address.
This is, therefore, expected behavior.
See: https://support.checkpoint.com/results/sk/sk102041